I feel like Page Visibility API should be locked behind a permission toggle, which would ask whenever the website tries to listen to any of those events, and will not trigger the events until the user agrees to give the permission (whether or not the user grants the permission should not be revealed to the website). The ability for a website to see when you click on things outside of the page itself (either by changing active window or tab) is quite unexpected from an end-user perspective, and its use in various "ed tech" websites to detect alleged cheating[1] is frightening, to say the least. Other than that, it's also used in many other anti-user implementations of ads or other content in order to force you to watch them in their entirety.
Edit: If you want to protect yourself from such abuse, try an extension that spoofs the API.
You can try: "Always active window" on Firefox or "Don't make me watch" on Chrome.
Edit: If you want to protect yourself from such abuse, try an extension that spoofs the API.
You can try: "Always active window" on Firefox or "Don't make me watch" on Chrome.
Test it with this website (not mine): https://testdrive-archive.azurewebsites.net/Performance/Page...
1. https://prioritylearn.com/teachers-canvas-tabs/